CVE-2026-12757

Executive Summary

CVE-2026-12757 is an unauthenticated arbitrary shortcode execution vulnerability affecting the "The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin" (hereafter "Email Subscribers") for WordPress, in all versions up to and including 5.9.27. The flaw stems from insufficient input validation before the WordPress do_shortcode function is invoked, allowing unauthenticated remote attackers to execute arbitrary shortcodes on affected sites. Successful exploitation can lead to partial loss of confidentiality and integrity (CVSS 6.5), potentially enabling content injection, information disclosure, or abuse of privileged shortcode functionality. As of this report, no patch is available, and the vendor has not released a fixed version.

Technical Analysis

The vulnerability resides in the Email Subscribers plugin (vendor: Icegram) and is classified under CWE-94 (Improper Control of Generation of Code — Code Injection). The NVD description indicates that the plugin "allows users to execute an action that does not properly validate a value before running do_shortcode." This is a classic shortcode injection flaw within the WordPress ecosystem.

Vulnerability Mechanism: The plugin registers one or more actions accessible to unauthenticated users (likely via admin-ajax.php or a custom REST endpoint, though the exact endpoint is not disclosed in the available data). When such an action is triggered, the plugin passes a user-controlled value — such as a POST parameter, GET parameter, or shortcode attribute — directly to the WordPress do_shortcode() function without adequate sanitization, validation, or capability checks (e.g., current_user_can()).

Consequence: Because WordPress shortcodes often encapsulate powerful functionality (e.g., fetching and displaying arbitrary content, executing other shortcodes registered by other plugins, or rendering user-supplied templates), an attacker who can control the input passed to do_shortcode() can execute arbitrary shortcodes that the site has registered. This is not arbitrary PHP code execution in itself, but it can be escalated depending on which shortcodes are available on the target site.

Attack Surface: The attack surface is the publicly accessible WordPress installation running the vulnerable plugin. The flaw is triggerable pre-authentication (CVSS PR:N), so no valid credentials are required. The attack vector is network-based (AV:N) with low attack complexity (AC:L). No user interaction is required (UI:N).

Technical details not available: The specific action hook name, parameter name, and the exact code path are not disclosed in the NVD description or CNA title. Therefore, the precise function names and parameter identifiers cannot be enumerated in this report. Analysts should treat any functionality exposed by Email Subscribers ≤ 5.9.27 that accepts user input and renders shortcodes as potentially affected.

Version scope: All versions up to and including 5.9.27 are vulnerable. No patched version has been identified (Patch Confidence: 0/4).

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-12757 at the time of writing. The following attack chain is inferred from the vulnerability class (arbitrary shortcode execution) and the NVD description. It is presented at a conceptual level without fabricated implementation details.

Step 1 — Reconnaissance and Target Identification. An attacker first identifies WordPress sites running the Email Subscribers plugin. This can be accomplished using mass scanning with tools like WPScan, or by querying public sources (e.g., the PublicWWW code search for markers like email-subscribers or icegram, or by fingerprinting the plugin's distinctive assets such as JavaScript/CSS files or readme.txt version strings). The Shodan dorks listed in the metadata can serve as supplementary discovery methods for exposed WordPress installations.

Step 2 — Triggering the Flaw. The attacker sends a crafted HTTP request to the vulnerable plugin's public-facing action handler. Because the vulnerability is reachable by unauthenticated users, the request does not need to include session cookies or authentication tokens. Based on the NVD description, the request must include a value that the plugin passes to do_shortcode() without validation. In practice, this is likely a GET or POST parameter that the plugin reads and then embeds into a shortcode call. At the vulnerability-class level, the attacker would identify which action handler is reachable pre-auth and which parameter it consumes; given insufficient public detail, the attacker would rely on fuzzing common parameter names or reviewing the plugin's publicly readable source code (plugins are distributed as PHP source, so the exact parameter is discoverable by static analysis of version 5.9.27).

Step 3 — Payload Execution. The attacker crafts a payload string containing shortcode syntax, e.g., [some_shortcode argument="value"], and injects it into the vulnerable parameter. When the plugin executes do_shortcode() on this string, WordPress parses and executes every shortcode present in the payload. The impact is determined by which shortcodes are registered site-wide:

• If a plugin registers a shortcode that writes to the database or outputs sensitive data, the attacker can leverage it for content injection or information disclosure.
• If a shortcode allows file inclusion, template rendering, or calling other dynamic functions, the attacker may be able to escalate to more severe outcomes.

Step 4 — Post-Exploitation Impact. Depending on the shortcodes available, the attacker may achieve:

• Content injection (Integrity impact, LOW): Injecting arbitrary HTML or shortcode-generated content into pages/posts, which could be used for SEO spam or defacement.
• Information disclosure (Confidentiality impact, LOW): Abusing shortcodes that query and output private data, such as user details, drafts, or other restricted content, if such shortcodes exist on the target.
• Further compromise: In a worst-case scenario, chaining with other vulnerable plugins that register dangerous shortcodes could lead to arbitrary file read, SSRF, or even remote code execution — though no such chain is documented for this specific CVE.

No public PoC is available; this attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

Business Impact: The Email Subscribers plugin is widely used for email marketing, newsletter distribution, and post notifications. A successful unauthenticated attack can lead to:

• Data integrity compromise: An attacker could inject spam content or malicious links into site content, damaging brand reputation and potentially poisoning SEO rankings.
• Confidentiality breach: If shortcodes on the target expose internal data (drafts, private user meta, pending posts), an attacker could harvest sensitive information.
• Compliance risk: For sites handling PII (e.g., subscriber databases), even partial information disclosure may trigger notification obligations under GDPR/CCPA.

CVSS Analysis (6.5 High-Medium): The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N reflects:

• Network-accessible, low complexity, no privileges, no user interaction — easy to exploit at scale.
• Scope is Unchanged — the compromise is limited to the vulnerable component's security authority.
• Confidentiality and Integrity impacts are LOW, and Availability is NOT affected. The low CIA ratings temper the overall severity, but the ease of exploitation and lack of authentication still make this a serious concern for exposed WordPress installations.

Affected Systems: All WordPress deployments running Email Subscribers ≤ 5.9.27. Given the plugin's popularity in the email-marketing niche, this could represent tens of thousands of sites. The MISP and OSV package databases do not list a fixed version, reinforcing the "unpatched" status.

Blast Radius: The practical blast radius is constrained by the shortcodes available on each target. On a minimal WordPress install (only Email Subscribers), the plugin's own shortcodes may have limited impact. However, on sites with additional plugins (e.g., WooCommerce, membership plugins, page builders), the availability of sensitive shortcodes can significantly amplify the impact, potentially enabling account enumeration, price manipulation, or other vertical privesc paths.

Detection Guidance

The following detection rules are designed to identify exploitation attempts targeting CVE-2026-12757. Given the lack of a specific endpoint name, the rules focus on generic indicators of shortcode injection: requests containing do_shortcode, [ shortcode syntax in unexpected parameters, or distinctive plugin fingerprints. Tune these rules based on your environment's baseline traffic to reduce false positives.

Sigma Rule

title: WordPress Email Subscribers Plugin Arbitrary Shortcode Execution Attempt
id: 3a8f0e1c-2b6e-4f8a-9c2d-7a5e1b0f9c44
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2026-12757 by injecting shortcode syntax into parameters handled by the Email Subscribers plugin.
author: Valtersit Threat Intelligence
date: 2026/02/14
logsource:
  category: webserver
  product: apache
  # Adjust to match your webserver (nginx, iis, etc.)
detection:
  selection:
    uri_query|contains:
      - 'do_shortcode'
      - '%5B'          # URL-encoded '['
    uri_path|contains:
      - 'admin-ajax.php'
      - 'email-subscribers'
  keywords:
    - 'mailpoet'
    - 'email-subscribers'
    - 'ig_es'
  condition: selection and keywords
falsepositives:
  - Legitimate administrative use of shortcodes via the WordPress admin panel (should be filtered by auth checks if the rule is applied to unauthenticated sessions).
  - Other plugins that use 'do_shortcode' in public-facing forms.
level: high
tags:
  - attack.t1190
  - cve.2026-12757
  - cwe.94

YARA Rule

rule CVE_2026_12757_Email_Subscribers_Shortcode_Injection {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-02-14"
        description = "Detects payload patterns and plugin markers associated with CVE-2026-12757 arbitrary shortcode execution in Email Subscribers plugin."
        cve = "CVE-2026-12757"
        severity = "high"
    strings:
        $plugin_marker1 = "email-subscribers" ascii wide nocase
        $plugin_marker2 = "ig_es" ascii wide nocase
        $plugin_marker3 = "icegram" ascii wide nocase
        $shortcode_open = "[__SHORTCODE_OPEN__]" ascii wide
        // Look for patterns like `[shortcode` or `[/shortcode`
        $shortcode_pattern1 = /\[\/?[a-zA-Z0-9_-]+/ ascii wide
        $shortcode_pattern2 = "%5B%2F%3F" ascii wide  // URL-encoded "[/?" or "["
        $func_ref = "do_shortcode" ascii wide
    condition:
        (uint16(0) == 0x4D5A or uint16(0) == 0x5A4D) and // PE file (malware dropping payload)
        (1 of ($plugin_marker*) and (2 of ($shortcode_pattern*) or $func_ref))
}

Note: The YARA rule above is intentionally generic for the HTTP-traffic/payload context. For filesystem scanning of compromised WordPress files, adjust the condition to look for injected shortcodes in PHP files (e.g., $shortcode_pattern1 in .php files that are not part of the original plugin's legitimate shortcode registrations).

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-12757 WordPress Email Subscribers Arbitrary Shortcode Execution Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/"; http_uri; pcre:"/(admin-ajax\.php|email-subscribers|ig_es)/i"; pcre:"/(do_shortcode|%5B|%5D|\x5b|\x5d)/i"; classtype:attempted-admin; sid:202612757; rev:1; reference:cve,2026-12757;)

Explanation: This rule alerts on HTTP GET requests (adjust for POST if your env sees POST-based AJAX) targeting paths associated with the plugin and containing shortcode bracket characters ([ = %5B, ] = %5D) or the literal do_shortcode string in the URI. Because POST bodies are not inspected by default in Suricata's HTTP parser without additional configuration, consider adding a flowint rule or using the file_data inspect for POST bodies in a tuned environment.

Elastic Detection

// EQL query for Elastic Security — detect HTTP requests with shortcode payloads to the plugin
sequence by host.name, source.ip with maxspan=5m
  [ network where event.category == "web" and network.protocol == "http" and
    url.path like~ "*admin-ajax.php*" and
    url.query like~ "*%5B*" or url.query like~ "*do_shortcode*" or url.query like~ "*[/?*" ]
  [ process where event.action == "exec-command" and process.args like~ "*php*" ]

Note: The second event (process execution) is illustrative — exploit payloads may not spawn processes. For a pure HTTP-layer detection (no EDR), simplify to:

network where event.category == "web" and network.protocol == "http" and
  (url.path like~ "*email-subscribers*" or url.path like~ "*ig_es*") and
  (url.query like~ "*%5B*" or url.query like~ "*do_shortcode*")

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%admin-ajax.php%") OR like(uri_path, "%email-subscribers%") OR like(uri_path, "%ig_es%")
| rex field=uri_query "(?<shortcode_bracket>%5B|%5D|\[|\])"
| where isnotnull(shortcode_bracket) OR like(uri_query, "%do_shortcode%")
| eval threat_name="CVE-2026-12757_Shortcode_Injection"
| table _time, src_ip, uri_path, uri_query, http_user_agent, status
| sort - _time

For broader coverage including POST requests (common for admin-ajax.php), also ingest and search raw POST body data if your logging pipeline captures it:

index=proxy OR index=web
| search (uri_path="*admin-ajax.php*" AND form_data=*%5B*) OR (uri_path="*admin-ajax.php*" AND form_data=*do_shortcode*)
| stats count by src_ip, uri_path, form_data, _time

Wazuh OSSEC Rule

<group name="wordpress,cve-2026-12757,">
  <rule id="100257" level="10">
    <decoded_as>web</decoded_as>
    <description>WordPress Email Subscribers CVE-2026-12757 shortcode injection attempt</description>
    <match>admin-ajax.php|email-subscribers|ig_es</match>
    <regex>(\%5B|\%5D|\[|\]|do_shortcode)</regex>
    <group>attack.t1190,cwe.94,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Note: Place in /var/ossec/etc/rules/local_rules.xml or a custom rule file. Adjust the decoded_as to match your Apache/Nginx decoder (e.g., decoded_as>web is typical for Apache logs in Wazuh 4.x). Test in a lab environment to verify parsing of your web logs.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source, and no vendor fix is available as of this reporting date.

1. Immediate Mitigations (until a patch is released)

• Disable or remove the plugin: If Email Subscribers is not business-critical, deactivate and uninstall it immediately from all WordPress installations. This is the only 100% effective mitigation.
• Web Application Firewall (WAF) rules: If the plugin cannot be removed, deploy virtual-patching WAF rules that block requests meeting the criteria in the detection rules above — specifically blocking any request containing %5B, %5D, or do_shortcode in parameters destined for the plugin's AJAX endpoints.
• Restrict access to admin-ajax.php: Implement IP-based allowlisting or additional authentication for admin-ajax.php where feasible, though this may break legitimate functionality.
• Disable XML-RPC: If not required, disable XML-RPC (add_filter('xmlrpc_enabled', '__return_false');) to reduce attack surface, though this does not directly patch the flaw.

2. Patch/Upgrade Steps

• Monitor for vendor release: Subscribe to the plugin's changelog on the WordPress Plugin Directory and Icegram's official channels. Watch for a version > 5.9.27.
• Apply patches when available: Once released, update all affected sites to the patched version. Test in a staging environment first.
• Check OSV / MISP feeds: Review OSV database entries for wordpress:email-subscribers or similar package identifiers periodically for a patched version reference.

3. Long-Term Hardening

• Least privilege for plugins: Audit all installed plugins; remove those that are unmaintained or that expose unauthenticated AJAX actions.
• WordPress core and plugin update policy: Establish a policy to apply security updates within 48 hours of release.
• Shortcode auditing: Review custom and third-party shortcodes site-wide. Remove or restrict any shortcode that performs sensitive operations (e.g., database writes, file reads, data export) so that a shortcode-injection flaw has minimal blast radius.
• Harden wp-config.php: Disable file editing and set DISALLOW_FILE_EDIT to true.
• Regular backups and integrity monitoring: Use file integrity monitoring (e.g., Wazuh FIM, Tripwire) to detect unauthorized changes to plugin files and theme templates.

References

1. NVD Entry — CVE-2026-12757: https://nvd.nist.gov/vuln/detail/CVE-2026-12757
2. WordPress Plugin Directory — Email Subscribers & Newsletters: https://wordpress.org/plugins/email-subscribers/
3. Icegram (Vendor) Official Website: https://www.icegram.com/
4. CWE-94 — Code Injection: https://cwe.mitre.org/data/definitions/94.html
5. ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor Campaigns / Exploit-in-the-Wild: As of the writing date, there is no public evidence of exploitation in the wild, no known threat actor campaigns referencing CVE-2026-12757, and no inclusion on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score has not yet been assigned by FIRST.org. These details should be revisited as new information becomes available, as unauthenticated WordPress flaws of this nature are frequently weaponized within days.

Report prepared by Valtersit Cyber Threat Intelligence. Analysis based exclusively on the provided CVE intelligence data. Confidence in technical details is limited by the sparseness of the NVD description; several implementation specifics (endpoint names, parameters) could not be confirmed and are deliberately omitted to prevent inaccuracy.